CVE-2023-41708 MEDIUM

CVE-2023-41708

Vendor Open-Xchange Gmbh
Product OX App Suite
Weakness CWE-79 · XSS
Published February 12, 2024
Last update November 4, 2025

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.

Key dates

02Disclosure timeline

February 12, 2024 CVE published
November 4, 2025 Record updated